Summary
- Environment: Alliance Medinet membership database and downstream insurer records
- Operational impact: Containment measures reported; no service outage established in the reviewed notices
- Financial impact: No verified financial loss in the reviewed evidence
- Record status: Developing record. Reviewed October 26, 2026; updated as evidence emerges.
What happened
Alliance Healthcare Group disclosed unauthorized access to the membership database of its subsidiary Alliance Medinet on October 24, 2026. Its SGX announcement said approximately 110,000 members’ personal data had been compromised, with the investigation continuing. The filing does not establish when the intrusion began or was discovered. [1]
Impact
Potentially affected information included names, identification numbers and contact details. The initial assessment also identified possible bank-account information exposure for seven members and a possible medical-diagnosis exposure for one member. These narrower categories were still being investigated. [1]
Income Insurance reported about 70 affected individuals in one corporate account. Its notice included possible exposure of policy numbers and coverage dates alongside identifiers and contact details. It found no current evidence of bank or medical information compromise and no indication that its own systems were compromised. [2]
Singlife said 323 Employee Benefits customers might be affected. Potential fields included names, NRIC numbers, birth dates, contact details, corporate email addresses, company names, and policy or membership details. It reported no evidence of compromise to its own systems or network, and no indication that health or medical information was affected. [3]
The insurer figures describe downstream subsets and should not be added to Medinet’s approximate total. Their limited no-evidence statements do not negate the vendor’s findings about other members. Alliance Healthcare said its other subsidiaries were unaffected. [1][2][3]
Timeline
Incident reported to privacy regulator
The group reported the incident to Singapore’s Personal Data Protection Commission.
[1]Briefing updated
This briefing was last reviewed and updated on October 26, 2026.
Threat Group & Attack Vector
The issuer confirmed unauthorized database access but did not identify the entry route or an exploited vulnerability. [1]
Actors
- No threat actor is identified in the reviewed original notices.
TTPs
- The available evidence does not support a specific MITRE ATT&CK technique mapping.
Response
Alliance Healthcare said it acted immediately to contain the incident. It engaged independent cybersecurity and forensic specialists, strengthened controls, and introduced continuous network and dark-web monitoring. Notifications were underway through Medinet, its partners and clients. [1]
Income’s notice and Singlife’s notice describe notifying authorities and contacting affected parties. The investigation had not established a final, deduplicated population or a complete per-person data inventory. [1][2][3]